Add certificate verification status to x509_cert input

plugins/inputs/x509_cert/README.md

@@ -19,9 +19,6 @@ file or network connection.
   # tls_ca = "/etc/telegraf/ca.pem"
   # tls_cert = "/etc/telegraf/cert.pem"
   # tls_key = "/etc/telegraf/key.pem"
-
-  ## Use TLS but skip chain & host verification
-  # insecure_skip_verify = false
 ```
 
 
@@ -35,7 +32,10 @@ file or network connection.
     - country
     - province
     - locality
+    - validation
   - fields:
+    - validation (int)
+    - validation_error (string)
     - expiry (int, seconds)
     - age (int, seconds)
     - startdate (int, seconds)
@@ -45,6 +45,8 @@ file or network connection.
 ### Example output
 
 ```
-x509_cert,host=myhost,source=https://example.org age=1753627i,expiry=5503972i,startdate=1516092060i,enddate=1523349660i 1517845687000000000
-x509_cert,host=myhost,source=/etc/ssl/certs/ssl-cert-snakeoil.pem age=7522207i,expiry=308002732i,startdate=1510323480i,enddate=1825848420i 1517845687000000000
+x509_cert,common_name=ubuntu,source=/etc/ssl/certs/ssl-cert-snakeoil.pem,validation=success age=7693222i,enddate=1871249033i,expiry=307666777i,startdate=1555889033i,validation=0i 1563582256000000000
+x509_cert,common_name=www.example.org,country=US,locality=Los\ Angeles,organization=Internet\ Corporation\ for\ Assigned\ Names\ and\ Numbers,organizational_unit=Technology,province=California,source=https://example.org:443,validation=fail age=20219055i,enddate=1606910400i,expiry=43328144i,startdate=1543363200i,validation=1i,validation_error="x509: certificate signed by unknown authority" 1563582256000000000
+x509_cert,common_name=DigiCert\ SHA2\ Secure\ Server\ CA,country=US,organization=DigiCert\ Inc,source=https://example.org:443,validation=success age=200838255i,enddate=1678276800i,expiry=114694544i,startdate=1362744000i,validation=0i 1563582256000000000
+x509_cert,common_name=DigiCert\ Global\ Root\ CA,country=US,organization=DigiCert\ Inc,organizational_unit=www.digicert.com,source=https://example.org:443,validation=success age=400465455i,enddate=1952035200i,expiry=388452944i,startdate=1163116800i,validation=0i 1563582256000000000
 ```

plugins/inputs/x509_cert/dev/telegraf.conf

@@ -1,5 +1,4 @@
 [[inputs.x509_cert]]
-    sources = ["https://www.influxdata.com:443"]
+  sources = ["https://expired.badssl.com:443", "https://wrong.host.badssl.com:443"]
 
 [[outputs.file]]
-  files = ["stdout"]

plugins/inputs/x509_cert/x509_cert.go

@@ -30,9 +30,6 @@ const sampleConfig = `
   # tls_ca = "/etc/telegraf/ca.pem"
   # tls_cert = "/etc/telegraf/cert.pem"
   # tls_key = "/etc/telegraf/key.pem"
-
-  ## Use TLS but skip chain & host verification
-  # insecure_skip_verify = false
 `
 const description = "Reads metrics from a SSL certificate"
 
@@ -53,14 +50,26 @@ func (c *X509Cert) SampleConfig() string {
 	return sampleConfig
 }
 
-func (c *X509Cert) getCert(location string, timeout time.Duration) ([]*x509.Certificate, error) {
+func (c *X509Cert) locationToURL(location string) (*url.URL, error) {
 	if strings.HasPrefix(location, "/") {
 		location = "file://" + location
 	}
 
 	u, err := url.Parse(location)
 	if err != nil {
-		return nil, fmt.Errorf("failed to parse cert location - %s\n", err.Error())
+		return nil, fmt.Errorf("failed to parse cert location - %s", err.Error())
+	}
+
+	return u, nil
+}
+
+func (c *X509Cert) getCert(u *url.URL, timeout time.Duration) ([]*x509.Certificate, *tls.Config, error) {
+	tlsCfg, err := c.ClientConfig.TLSConfig()
+	if err != nil {
+		return nil, nil, err
+	}
+	if tlsCfg == nil {
+		tlsCfg = &tls.Config{}
 	}
 
 	switch u.Scheme {
@@ -70,51 +79,44 @@ func (c *X509Cert) getCert(location string, timeout time.Duration) ([]*x509.Cert
 	case "udp", "udp4", "udp6":
 		fallthrough
 	case "tcp", "tcp4", "tcp6":
-		tlsCfg, err := c.ClientConfig.TLSConfig()
-		if err != nil {
-			return nil, err
-		}
-
 		ipConn, err := net.DialTimeout(u.Scheme, u.Host, timeout)
 		if err != nil {
-			return nil, err
+			return nil, nil, err
 		}
 		defer ipConn.Close()
 
-		if tlsCfg == nil {
-			tlsCfg = &tls.Config{}
-		}
 		tlsCfg.ServerName = u.Hostname()
+		tlsCfg.InsecureSkipVerify = true
 		conn := tls.Client(ipConn, tlsCfg)
 		defer conn.Close()
 
 		hsErr := conn.Handshake()
 		if hsErr != nil {
-			return nil, hsErr
+			return nil, nil, hsErr
 		}
 
 		certs := conn.ConnectionState().PeerCertificates
 
-		return certs, nil
+		return certs, tlsCfg, nil
 	case "file":
 		content, err := ioutil.ReadFile(u.Path)
 		if err != nil {
-			return nil, err
+			return nil, nil, err
 		}
 
 		block, _ := pem.Decode(content)
 		if block == nil {
-			return nil, fmt.Errorf("failed to parse certificate PEM")
+			return nil, nil, fmt.Errorf("failed to parse certificate PEM")
 		}
 
 		cert, err := x509.ParseCertificate(block.Bytes)
 		if err != nil {
-			return nil, err
+			return nil, nil, err
 		}
 
-		return []*x509.Certificate{cert}, nil
+		return []*x509.Certificate{cert}, tlsCfg, nil
 	default:
-		return nil, fmt.Errorf("unsuported scheme '%s' in location %s\n", u.Scheme, location)
+		return nil, nil, fmt.Errorf("unsuported scheme '%s' in location %s", u.Scheme, u.String())
 	}
 }
 
@@ -164,15 +166,38 @@ func (c *X509Cert) Gather(acc telegraf.Accumulator) error {
 	now := time.Now()
 
 	for _, location := range c.Sources {
-		certs, err := c.getCert(location, c.Timeout.Duration*time.Second)
+		u, err := c.locationToURL(location)
+		if err != nil {
+			acc.AddError(err)
+		}
+
+		certs, tlsCfg, err := c.getCert(u, c.Timeout.Duration*time.Second)
 		if err != nil {
 			acc.AddError(fmt.Errorf("cannot get SSL cert '%s': %s", location, err.Error()))
 		}
 
-		for _, cert := range certs {
+		for i, cert := range certs {
 			fields := getFields(cert, now)
 			tags := getTags(cert.Subject, location)
 
+			opts := x509.VerifyOptions{}
+			if i == 0 {
+				opts.DNSName = u.Hostname()
+			}
+			if tlsCfg.RootCAs != nil {
+				opts.Roots = tlsCfg.RootCAs
+			}
+
+			_, err = cert.Verify(opts)
+			if err == nil {
+				tags["validation"] = "success"
+				fields["validation"] = 0
+			} else {
+				tags["validation"] = "fail"
+				fields["validation"] = 1
+				fields["validation_error"] = err.Error()
+			}
+
 			acc.AddFields("x509_cert", fields, tags)
 		}
 	}